993 vulnerabilities patched by Microsoft in the September 2026 Patch Tuesday release.

Severity Breakdown

  • Critical: 132
  • Important: 861

Actively Exploited (2)

CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability

CVSS 7.8 | Windows Update Stack | Actively Exploited

CVE-2026-85880 — Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

CVSS 7.8 | Windows ALPC | Actively Exploited

Exploitation More Likely (58)

  • CVE-2026-69525 — Remote Desktop Services Remote Code Execution Vulnerability (CVSS 9.8, Windows Remote Desktop Services)
  • CVE-2026-69730 — Windows DNS Server Remote Code Execution Vulnerability (CVSS 9.8, Windows DNS)
  • CVE-2026-69854 — Spring Cloud Azure Elevation of Privilege Vulnerability (CVSS 9.0, Spring Cloud Azure)
  • CVE-2026-69676 — Windows Kerberos Remote Code Execution Vulnerability (CVSS 8.8, Windows Kerberos)
  • CVE-2026-72940 — Windows Schannel Remote Code Execution Vulnerability (CVSS 8.8, Windows Schannel)
  • CVE-2026-69857 — Azure Cosmos DB Spoofing Vulnerability (CVSS 8.5, Azure Cosmos DB)
  • CVE-2026-70342 — Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 8.1, Windows Ancillary Function Driver for WinSock)
  • CVE-2026-72936 — Windows SMB Client Remote Code Execution Vulnerability (CVSS 8.1, Windows SMB Client)
  • CVE-2026-68876 — Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability (CVSS 8.0, Windows Program Compatibility Assistant Service)
  • CVE-2026-68880 — Windows Win32k Elevation of Privilege Vulnerability (CVSS 8.0, Windows Win32K)
  • CVE-2026-69301 — Windows Win32k Elevation of Privilege Vulnerability (CVSS 8.0, Windows Win32K)
  • CVE-2026-69623 — Windows HTTP Print Provider Remote Code Execution Vulnerability (CVSS 8.0, Windows HTTP Print Provider)
  • CVE-2026-69714 — Windows Device Association Service Elevation of Privilege Vulnerability (CVSS 8.0, Windows Device Association Service)
  • CVE-2026-69777 — Windows DHCP Client Elevation of Privilege Vulnerability (CVSS 8.0, Windows DHCP Client)
  • CVE-2026-69277 — Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Local Security Authority Server (lsasrv))
  • CVE-2026-69391 — Windows Broker Infrastructure Service Elevation of Privilege Vulnerability (CVSS 7.8, Windows Broker Infrastructure Service)
  • CVE-2026-69436 — Windows State Repository Service Elevation of Privilege Vulnerability (CVSS 7.8, Windows State Repository Service)
  • CVE-2026-69450 — Windows Error Reporting Elevation of Privilege Vulnerability (CVSS 7.8, Windows Error Reporting)
  • CVE-2026-69459 — Windows Power Dependency Coordinator Elevation of Privilege Vulnerability (CVSS 7.8, Windows Power Dependency Coordinator)
  • CVE-2026-69467 — Microsoft Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Graphics Component)
  • +38 more

Executive Summary

Microsoft’s September 2026 Patch Tuesday is one of the largest on record, addressing 993 vulnerabilities across the Windows ecosystem, Azure cloud services, Office suite, SQL Server, and numerous supporting components. Of these, 132 are rated Critical and 58 carry Microsoft’s “Exploitation More Likely” designation, signaling a broad and urgent patching cycle. Two vulnerabilities are confirmed under active exploitation: CVE-2026-81963, an elevation of privilege in the Windows Update Stack, and CVE-2026-85880, an elevation of privilege in Windows ALPC. Both carry a CVSS score of 7.8 and provide local privilege escalation, meaning they are likely being chained with initial access vectors in real-world attacks. These two zero-days should be treated as the highest priority for endpoint teams, particularly on systems where standard users operate and lateral movement risk is elevated.

On the cloud and identity side, this release contains an extraordinary cluster of CVSS 10.0 elevation of privilege vulnerabilities spanning Azure Billing, Azure Arc, Microsoft Fabric, Azure Container Registry, Azure Logic Apps, Azure AI Language, Azure AD B2C, and Azure AI Foundry. A separate Entra ID flaw scores 9.9. While many of these are service-side issues that Microsoft may remediate without customer action, security teams running hybrid or self-managed Azure Arc deployments should verify their update status immediately. The Entra ID vulnerability in particular warrants attention from identity and access management teams given its potential to compromise authentication trust boundaries. Organizations should confirm with Microsoft advisories whether any of these require tenant-level configuration changes or customer-side patching.

The on-premises attack surface is equally significant. SQL Server accounts for 61 vulnerabilities including 5 critical, making it a priority for database administrators. Microsoft Office products are heavily affected, with Excel carrying 6 critical flaws and Word carrying 2, creating substantial risk from weaponized documents delivered via email or collaboration platforms. Windows DHCP Server has 36 patches including 2 critical, and Windows DNS has 14 patches with 4 critical — both are infrastructure services that should be patched in the next maintenance window. The Windows Biometric Service leads in raw volume at 64 fixes, though none are critical.

Given the scale of this release, security teams should triage in three waves. First, patch the two actively exploited zero-days on all Windows endpoints without delay. Second, coordinate with cloud and identity teams to validate exposure to the CVSS 10.0 Azure and Entra ID vulnerabilities and confirm remediation status. Third, schedule infrastructure patching for DNS, DHCP, and SQL Server, and push Office updates through your standard deployment channels with urgency given the critical document-parsing flaws. With 58 vulnerabilities flagged as “Exploitation More Likely,” the window between patch availability and weaponization will be short.

Critical Vulnerabilities

Azure Billing (1 Critical)

  • CVE-2026-62874 — Azure Billing Elevation of Privilege Vulnerability (CVSS 10.0) Advisory

Azure Arc (2 Critical)

  • CVE-2026-69399 — Azure Arc Elevation of Privilege Vulnerability (CVSS 10.0) Advisory
  • CVE-2026-70009 — Azure Arc Elevation of Privilege Vulnerability (CVSS 9.3) Advisory

Microsoft Fabric (2 Critical)

  • CVE-2026-69843 — Microsoft Fabric Elevation of Privilege Vulnerability (CVSS 10.0) Advisory
  • CVE-2026-70178 — Microsoft Fabric Elevation of Privilege Vulnerability (CVSS 8.5) Advisory

Microsoft Container Registry (1 Critical)

  • CVE-2026-69865 — Microsoft Container Registry Elevation of Privilege Vulnerability (CVSS 10.0) Advisory

Azure Logic Apps (2 Critical)

  • CVE-2026-70200 — Azure Logic Apps Elevation of Privilege Vulnerability (CVSS 10.0) Advisory
  • CVE-2026-83944 — Azure Logic Apps Elevation of Privilege Vulnerability (CVSS 10.0) Advisory

Azure AI Language (1 Critical)

  • CVE-2026-70352 — Azure AI Language Elevation of Privilege Vulnerability (CVSS 10.0) Advisory

Microsoft Azure Active Directory B2C (1 Critical)

  • CVE-2026-83711 — Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability (CVSS 10.0) Advisory

Azure AI Foundry (2 Critical)

  • CVE-2026-85889 — Azure AI Foundry Elevation of Privilege Vulnerability (CVSS 10.0) Advisory
  • CVE-2026-85917 — Azure AI Foundry Elevation of Privilege Vulnerability (CVSS 7.5) Advisory

Entra ID (1 Critical)

  • CVE-2026-83941 — Entra ID Elevation of Privilege Vulnerability (CVSS 9.9) Advisory

Azure Database for PostgreSQL (1 Critical)

  • CVE-2026-85878 — Azure Database for PostgreSQL Elevation of Privilege Vulnerability (CVSS 9.9) Advisory

M365 Copilot (2 Critical)

  • CVE-2026-85885 — Microsoft 365 Copilot Elevation of Privilege Vulnerability (CVSS 9.9) Advisory
  • CVE-2026-85887 — M365 Copilot Information Disclosure Vulnerability (CVSS 7.7) Advisory

Skype for Business (1 Critical)

  • CVE-2026-66302 — Skype for Business Remote Code Execution Vulnerability (CVSS 9.8) Advisory

SQL Server (5 Critical)

  • CVE-2026-67631 — Microsoft SQL Server Remote Code Execution Vulnerability (CVSS 9.8) Advisory
  • CVE-2026-67643 — Microsoft SQL Server Remote Code Execution Vulnerability (CVSS 9.8) Advisory
  • CVE-2026-65669 — Microsoft SQL Server Elevation of Privilege Vulnerability (CVSS 9.6) Advisory
  • CVE-2026-67378 — Microsoft SQL Server Remote Code Execution Vulnerability (CVSS 9.0) Advisory
  • CVE-2026-67636 — Microsoft SQL Server Remote Code Execution Vulnerability (CVSS 9.0) Advisory

Windows Message Queuing (1 Critical)

  • CVE-2026-69579 — Windows Message Queuing Remote Code Execution Vulnerability (CVSS 9.8) Advisory

Windows Routing and Remote Access Service (RRAS) (4 Critical)

  • CVE-2026-69590 — Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 9.8) Advisory
  • CVE-2026-72950 — Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-72959 — Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-69852 — Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 7.5) Advisory

Windows Services for NFS ONCRPC XDR Driver (3 Critical)

  • CVE-2026-69595 — Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (CVSS 9.8) Advisory
  • CVE-2026-78445 — Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (CVSS 9.8) Advisory
  • CVE-2026-70585 — Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (CVSS 7.0) Advisory

Windows DNS (4 Critical)

  • CVE-2026-69730 — Windows DNS Server Remote Code Execution Vulnerability (CVSS 9.8) Advisory
  • CVE-2026-69813 — Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.1) Advisory
  • CVE-2026-69858 — Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.1) Advisory
  • CVE-2026-72987 — Windows DNS Remote Code Execution Vulnerability (CVSS 8.1) Advisory

Windows HTTP Print Provider (1 Critical)

  • CVE-2026-69769 — Windows HTTP Print Provider Remote Code Execution Vulnerability (CVSS 9.8) Advisory

Windows Shell (1 Critical)

  • CVE-2026-69829 — Windows Shell Remote Code Execution Vulnerability (CVSS 9.8) Advisory

Windows DHCP Server (2 Critical)

  • CVE-2026-69845 — Windows DHCP Server Remote Code Execution Vulnerability (CVSS 9.8) Advisory
  • CVE-2026-72979 — Windows DHCP Server Remote Code Execution Vulnerability (CVSS 9.8) Advisory

Windows Imaging Component (6 Critical)

  • CVE-2026-70296 — Windows Imaging Component Remote Code Execution Vulnerability (CVSS 9.8) Advisory
  • CVE-2026-69499 — Windows Imaging Component Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-69860 — Windows Imaging Component Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-73013 — Windows Imaging Component Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-73023 — Windows Imaging Component Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-77495 — Windows Imaging Component Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Windows Netlogon (1 Critical)

  • CVE-2026-72982 — Windows Netlogon Remote Code Execution Vulnerability (CVSS 9.8) Advisory

Windows Internet Connection Sharing (ICS) (1 Critical)

  • CVE-2026-72983 — Internet Connection Sharing (ICS) Remote Code Execution Vulnerability (CVSS 9.8) Advisory

Windows Secure Socket Tunneling Protocol (SSTP) (1 Critical)

  • CVE-2026-73009 — Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 9.8) Advisory

Windows Failover Cluster (2 Critical)

  • CVE-2026-73010 — Microsoft Failover Cluster Remote Code Execution Vulnerability (CVSS 9.8) Advisory
  • CVE-2026-78444 — Microsoft Failover Cluster Remote Code Execution Vulnerability (CVSS 8.1) Advisory

Microsoft Graphics Component (4 Critical)

  • CVE-2026-77493 — Windows Graphics Component Remote Code Execution Vulnerability (CVSS 9.8) Advisory
  • CVE-2026-73006 — DirectWrite Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-78439 — Microsoft Office Graphics Component Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-81955 — Windows Graphics Component Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Microsoft Office Outlook (4 Critical)

  • CVE-2026-78509 — Microsoft Office Outlook Remote Code Execution Vulnerability (CVSS 9.8) Advisory
  • CVE-2026-78519 — Microsoft Office Outlook Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-78525 — Microsoft Office Outlook Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-78520 — Microsoft Office Outlook Information Disclosure Vulnerability (CVSS 6.5) Advisory

Azure Cosmos DB (2 Critical)

  • CVE-2026-87701 — Azure Cosmos DB Elevation of Privilege Vulnerability (CVSS 9.6) Advisory
  • CVE-2026-69857 — Azure Cosmos DB Spoofing Vulnerability (CVSS 8.5) Advisory

Copilot Studio (1 Critical)

  • CVE-2026-80098 — Copilot Studio Elevation of Privilege Vulnerability (CVSS 9.3) Advisory

Microsoft Entra ID (1 Critical)

  • CVE-2026-62916 — Microsoft Entra ID Elevation of Privilege Vulnerability (CVSS 9.1) Advisory

Spring Cloud Azure (1 Critical)

  • CVE-2026-69854 — Spring Cloud Azure Elevation of Privilege Vulnerability (CVSS 9.0) Advisory

Microsoft Dataverse (1 Critical)

  • CVE-2026-77903 — Microsoft Dataverse Elevation of Privilege Vulnerability (CVSS 9.0) Advisory

Microsoft Dynamics 365 (1 Critical)

  • CVE-2026-65772 — Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Microsoft Office (5 Critical)

  • CVE-2026-69285 — Microsoft Office Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-69632 — Microsoft Office Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-78505 — Microsoft Office Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-78510 — Microsoft Outlook and Word Remote Code Execution Vulnerability (CVSS 8.4) Advisory
  • CVE-2026-77898 — Microsoft Office Remote Code Execution Vulnerability (CVSS 7.5) Advisory

Windows Remote Desktop (1 Critical)

  • CVE-2026-69518 — Windows Remote Desktop Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Microsoft Windows Media Foundation (1 Critical)

  • CVE-2026-69601 — Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Windows Hyper-V (3 Critical)

  • CVE-2026-69603 — Windows Hyper-V Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-80083 — Windows Hyper-V Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-72961 — Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 8.2) Advisory

Windows Raw Image Extension (1 Critical)

  • CVE-2026-69649 — Raw Image Extension Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Windows Kerberos (1 Critical)

  • CVE-2026-69676 — Windows Kerberos Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Microsoft Office PowerPoint (3 Critical)

  • CVE-2026-69678 — Microsoft Office PowerPoint Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-69767 — Microsoft Office PowerPoint Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-69797 — Microsoft Office PowerPoint Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Windows Key Distribution Center (1 Critical)

  • CVE-2026-69712 — Windows Key Distribution Center Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Windows Hello (9 Critical)

  • CVE-2026-69740 — Windows Hello Elevation of Privilege Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-69784 — Windows Hello Elevation of Privilege Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-69820 — Windows Hello Elevation of Privilege Vulnerability (CVSS 8.2) Advisory
  • CVE-2026-81354 — Windows Hello Elevation of Privilege Vulnerability (CVSS 8.2) Advisory
  • CVE-2026-69725 — Windows Hello Elevation of Privilege Vulnerability (CVSS 7.8) Advisory
  • CVE-2026-69799 — Windows Hello Elevation of Privilege Vulnerability (CVSS 7.8) Advisory
  • CVE-2026-69864 — Windows Hello Elevation of Privilege Vulnerability (CVSS 7.8) Advisory
  • CVE-2026-69710 — Windows Hello Elevation of Privilege Vulnerability (CVSS 7.5) Advisory
  • CVE-2026-72980 — Windows Hello Security Feature Bypass Vulnerability (CVSS 4.4) Advisory

Windows Media Player (2 Critical)

  • CVE-2026-70203 — Windows Media Player Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-72960 — Windows Media Player Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Microsoft WebP Image Extension (1 Critical)

  • CVE-2026-70351 — Microsoft WebP Image Extension Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Windows Paint (1 Critical)

  • CVE-2026-70586 — Windows Paint Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Graphic Fonts (2 Critical)

  • CVE-2026-72986 — Graphic Fonts Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-73018 — Graphic Fonts Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Microsoft Office Word (2 Critical)

  • CVE-2026-77504 — Microsoft Office Word Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-81952 — Microsoft Word Remote Code Execution Vulnerability (CVSS 8.8) Advisory

Microsoft Windows Codecs Library (2 Critical)

  • CVE-2026-81352 — Web Media Extensions Remote Code Execution Vulnerability (CVSS 8.8) Advisory
  • CVE-2026-58599 — HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8) Advisory

Azure Machine Learning (1 Critical)

  • CVE-2026-68791 — Azure Machine Learning Information Disclosure Vulnerability (CVSS 8.6) Advisory

Power Automate (1 Critical)

  • CVE-2026-65818 — Power Automate Elevation of Privilege Vulnerability (CVSS 8.5) Advisory

Windows Secure Kernel Mode (5 Critical)

  • CVE-2026-69846 — Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 8.2) Advisory
  • CVE-2026-69906 — Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 8.2) Advisory
  • CVE-2026-83939 — Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 8.2) Advisory
  • CVE-2026-85921 — Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 8.2) Advisory
  • CVE-2026-69501 — Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 7.0) Advisory

Windows ALPC (1 Critical)

  • CVE-2026-69874 — Windows ALPC Elevation of Privilege Vulnerability (CVSS 8.2) Advisory

Windows Credential Guard (1 Critical)

  • CVE-2026-72958 — Windows Credential Guard Elevation of Privilege Vulnerability (CVSS 8.2) Advisory

Windows USB Video Driver (1 Critical)

  • CVE-2026-72962 — Windows USB Video Driver Elevation of Privilege Vulnerability (CVSS 8.2) Advisory

Azure Portal (1 Critical)

  • CVE-2026-83946 — Azure Portal Spoofing Vulnerability (CVSS 8.2) Advisory

Reliable Multicast Transport Driver (RMCAST) (3 Critical)

  • CVE-2026-69530 — Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (CVSS 8.1) Advisory
  • CVE-2026-78449 — Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (CVSS 8.1) Advisory
  • CVE-2026-78450 — Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (CVSS 8.1) Advisory

Role: DNS Server (2 Critical)

  • CVE-2026-69827 — Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.1) Advisory
  • CVE-2026-77505 — Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.1) Advisory

IP Helper (1 Critical)

  • CVE-2026-72981 — IP Helper Remote Code Execution Vulnerability (CVSS 8.1) Advisory

Windows Deployment Services (2 Critical)

  • CVE-2026-72957 — Windows Deployment Services Remote Code Execution Vulnerability (CVSS 7.8) Advisory
  • CVE-2026-72954 — Windows Deployment Services Remote Code Execution Vulnerability (CVSS 7.5) Advisory

Microsoft Office Excel (6 Critical)

  • CVE-2026-81948 — Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8) Advisory
  • CVE-2026-81949 — Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8) Advisory
  • CVE-2026-81950 — Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8) Advisory
  • CVE-2026-81951 — Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8) Advisory
  • CVE-2026-81953 — Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8) Advisory
  • CVE-2026-81959 — Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8) Advisory

Windows Virtualization-Based Security (VBS) Enclave (2 Critical)

  • CVE-2026-83498 — Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (CVSS 7.8) Advisory
  • CVE-2026-83501 — Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability (CVSS 5.5) Advisory

Windows Virtual Trusted Platform Module (1 Critical)

  • CVE-2026-69890 — Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability (CVSS 7.5) Advisory

Windows Graphics Kernel (1 Critical)

  • CVE-2026-73017 — Graphics Kernel Remote Code Execution Vulnerability (CVSS 7.5) Advisory

Virtual Hard Disk (VHD) Miniport Driver (1 Critical)

  • CVE-2026-81355 — Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability (CVSS 7.5) Advisory

Microsoft Discovery Studio (1 Critical)

  • CVE-2026-62906 — Microsoft Discovery Studio Information Disclosure Vulnerability (CVSS 7.4) Advisory

Microsoft 365 Copilot’s Business Chat (1 Critical)

  • CVE-2026-78501 — Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability (CVSS 7.4) Advisory

Microsoft Copilot (1 Critical)

  • CVE-2026-55946 — Microsoft Copilot Information Disclosure Vulnerability (CVSS 6.1) Advisory

Product Family Breakdown

Product FamilyTotalCriticalImportant
Windows Biometric Service64064
SQL Server61556
Microsoft Office Word37235
Windows DHCP Server36234
Microsoft Office Excel32626
Windows NTFS29029
Windows Win32K23023
Microsoft Standard XPS18018
Windows Spaceport.sys17017
Microsoft Office16511
Microsoft Office SharePoint16016
Windows DNS14410
Windows Print Spooler Components12012
Windows Kernel11011
Windows Error Reporting11011
Microsoft Windows Search Component11011
Windows Device Association Service11011
Skype for Business1019
Microsoft Office PowerPoint1037
Visual Studio Code10010
Microsoft Exchange Server909
Remote Desktop Client909
Windows USB Audio Class driver (usbaudio.sys)909
Windows Remote Desktop Services909
Windows Hello990
Windows Audio Service808
Windows Imaging Component862
Microsoft Graphics Component844
Windows Routing and Remote Access Service (RRAS)844
Microsoft Office Outlook844
Windows Overlay Filter707
Windows Remote Access Connection Manager707
Virtual Hard Disk (VHD) Miniport Driver716
Microsoft Windows Media Foundation615
Active Directory Domain Services606
Windows MIDI Service Module606
Windows Program Compatibility Assistant Service606
Windows Modern Device Management (MDM)606
Windows Shell615
Windows TCP/IP606
Windows Services for NFS ONCRPC XDR Driver633
Windows Installer505
Windows Connected User Experiences and Telemetry505
Windows USB Driver505
Windows Storage Spaces Controller505
Windows Volume Manager Extension Driver505
Windows USB Video Driver514
Windows Secure Kernel Mode550
Windows Hyper-V532
Windows Kerberos514
Microsoft Windows Codecs Library422
Active Directory Certificate Services (AD CS)404
Windows iSCSI404
Windows CD-ROM Driver404
Windows Image Acquisition404
Windows Management Instrumentation404
Windows Bluetooth Service404
Microsoft Office Access404
Visual Studio404
Windows SMB Client404
Windows Deployment Services422
Role: DNS Server422
Windows Secure Socket Tunneling Protocol (SSTP)413
Windows Failover Cluster422
.NET303
Windows Push Notifications303
Azure Arc321
Windows File History Service303
Windows USB Mass Storage Class Driver303
Microsoft Local Security Authority Server (lsasrv)303
Windows Cloud Files Mini Filter Driver303
Volume Manager Driver303
Windows VOLSNAP.SYS303
Windows IKE Extension303
Microsoft Windows Speech303
Windows Compressed Folder303
Windows Partition Management Driver303
Windows Event Logging Service303
Role: Windows Fax Service303
Reliable Multicast Transport Driver (RMCAST)330
Windows Universal Disk Format File System Driver (UDFS)303
Graphic Fonts321
Windows Message Queuing312
Windows Encrypting File System (EFS)303
Windows Credential Providers303
Windows ALPC312
Windows Internet Connection Sharing (ICS)312
Storage Port Driver303
Microsoft Windows SCSI Class System File303
Windows Ancillary Function Driver for WinSock202
ASP.NET Core202
Windows Netlogon211
Windows PowerShell202
Microsoft Dynamics 365211
Microsoft Teams for Android202
Power Automate211
Windows GDI+202
Windows Universal Plug and Play (UPnP) Device Host202
Windows Defender Firewall Service202
Windows Bluetooth Port Driver202
Microsoft Account202
Windows Fast FAT Driver202
Windows Network Connection Broker202
Windows Message Queuing Queue Manager202
Windows Remote Desktop Licensing Service202
Kernel Streaming WOW Thunk Service Driver202
Windows License Manager202
Remote Desktop Gateway Service202
Microsoft COM for Windows202
Windows Device Association Broker service202
Windows Power Dependency Coordinator202
Microsoft JScript202
Windows Storage202
Windows Text Shaping202
Windows NDIS202
Windows Network File System202
Windows SMB Server202
Windows Storage Management Provider202
Windows Distributed File System (DFS)202
Windows URL Moniker202
Windows BitLocker202
Windows Enterprise App Management202
Windows RNDIS202
Windows Work Folder Service202
Windows Resilient File System (ReFS)202
Windows HTTP Print Provider211
Windows Accounts Control202
Windows Key Distribution Center211
Microsoft Office Publisher202
Windows DHCP Client202
Microsoft Fabric220
Azure Cosmos DB220
Azure Logic Apps220
Windows Media Player220
Windows Win32 Kernel Subsystem202
Windows Schannel202
Windows Credential Guard211
Windows Core Messaging202
Windows OLE DB202
GitHub Copilot and Visual Studio Code202
Windows Virtualization-Based Security (VBS) Enclave220
M365 Copilot220
Azure AI Foundry220
Microsoft Copilot110
Windows VHD miniport driver101
Windows Server101
Microsoft Trace Data Helper101
Windows RDP Client101
XBox Gaming Services101
Azure Billing110
Microsoft Discovery Studio110
Microsoft Entra ID110
Azure Machine Learning110
Windows Bind Filter Driver101
Internet Storage Name Service101
Microsoft UxTheme Library (uxtheme.dll)101
Windows DCOM Server101
Windows Setup Files Cleanup101
Push Message Routing Service101
Windows Performance Monitor101
BranchCache101
Windows Registry101
Windows Storage Port Driver101
Windows Broker Infrastructure Service101
OpenSSH for Windows101
Audio Video Control Transport Protocol101
Windows Kernel Mode Driver101
Windows LDAP - Lightweight Directory Access Protocol101
Windows Embedded Mode Service101
Telnet Client101
Windows State Repository Service101
.NET and Visual Studio101
Windows Device Health Attestation (DHA)101
Windows Devices Human Interface101
Windows Microsoft DirectMusic101
Connected Devices Platform Service (Cdpsvc)101
Windows Wireless Networking101
Windows Remote Desktop110
Windows Camera Frame Server Monitor101
Windows Online Certificate Status Protocol (OCSP)101
Microsoft Windows PDF101
Windows HTTP.sys101
Windows PrintWorkflowUserSvc101
Microsoft Install Service101
Windows exFAT File System101
Windows Notification101
Windows Raw Image Extension110
Windows Host Guardian Service101
Windows IP Address Management (IPAM) Service101
Windows Web Platform Storage101
Windows Secure Boot101
Windows Direct Show101
Windows Group Policy101
HID class driver101
Windows Link Layer Topology Discovery Protocol101
Windows Broadcast DVR User Service101
Windows Container Manager Service101
Windows DWM Core Library101
Windows Smart Card101
RPC Runtime101
Windows iSCSI Target Service101
Spring Cloud Azure110
Windows Wireless Wide Area Network Service101
Microsoft Container Registry110
Windows Virtual Trusted Platform Module110
Windows Media101
Microsoft WebP Image Extension110
Azure AI Language110
Windows AF_UNIX Socket Provider101
Windows Display Enhancement Service101
Windows Mobile Broadband101
Windows Paint110
Windows Remote Desktop Protocol101
Windows NFS Portmapper101
Winsock101
Microsoft WDAC OLE DB provider for SQL101
Windows Task Scheduler101
Windows SMB Server Network Transport Driver (srvnet.sys)101
Windows Modern Execution Server101
Windows WebClient Service101
Active Directory Federation Services (AD FS)101
IP Helper110
Windows Volume Shadow Copy101
Windows USB Hub Driver101
Windows Autopilot101
Windows Authentication Methods101
Windows Management Services101
Data Sharing Service Client101
Windows Graphics Kernel110
Windows GDI101
Windows Boot Manager101
Windows Security Center101
Microsoft Dataverse110
Azure CycleCloud101
Xbox101
Windows Security Health Service101
Microsoft 365 Copilot’s Business Chat110
Windows Work Folders101
Microsoft Authenticator101
Copilot Studio110
Azure HDInsights101
Windows Update Stack101
Microsoft Azure Active Directory B2C110
Entra ID110
Azure Portal110
Microsoft Azure CLI101
Windows Resilient File System (ReFS) Deduplication Service101
Microsoft Authentication Library (MSAL) for Node.js101
Azure Database for PostgreSQL110

Data sourced from the Microsoft Security Response Center. Mariner (Azure Linux) and Edge (Chromium-based) CVEs are excluded from this summary. Generated by ARETIQ AI.